Encrypt Online
Privacy All tools run entirely in your browser.

JWK Thumbprint Calculator

Hash the canonical public key fields and see exactly what counted

Safety note: RFC 7638 thumbprints are calculated from public JWK members only. If you paste a private JWK, the page ignores private members and tells you exactly what was left out.
Calculate an RFC 7638 JWK thumbprintPick one key from a JWK or JWKS, review the canonical JSON that gets hashed, and copy the stable Base64URL identifier
kid helps choose one key from a JWKS. It is not part of the thumbprint and does not affect the final digest.
Leave this blank for a single JWK. Add it only when the input is a multi-key JWKS.
What a JWK Thumbprint Is

A JWK thumbprint is a SHA-256 digest of a canonical JSON representation of the public key members defined by RFC 7638. It is stable for the same public key even when publishers change extra metadata like kid, alg, or use.

Calculate and Review
  1. Paste a single JWK or a JWKS document.
  2. Add kid if you need to choose one key from a larger set.
  3. Click Calculate thumbprint and review the canonical JSON preview.
  4. Copy the Base64URL value when you need an RFC 7638-style identifier.
Why It Differs from kid

kid is a publisher-chosen label. A thumbprint is derived from the public key itself. Two JWKs can share the same key material and therefore the same thumbprint even when their kid values differ.

FAQ
Do private JWK members change the thumbprint?

No. This page ignores private members and hashes only the RFC 7638 public-member set for the key type.

Why show the canonical JSON?

Because the normalization rules are the whole point. The JSON preview shows the exact member set and order that got hashed.

Is the hashing local-only?

Yes. JWK selection, normalization, and SHA-256 hashing stay in your browser.